Unresolved policy linking telecom license fees to dollar causes crisis, writes ZAFAR BHUTTA.
In pursuit of the government’s ambitious vision to attract US$20 billion in investments within the IT sector over the next 2-3 years, the telecom industry has emerged as a key player, holding the potential to contribute 25 per cent of Pakistan’s overall IT-related investment goals. However, amidst this promising outlook, the industry faces a critical threat to its survival – the unresolved policy linking telecom license fees to the US dollar.
The significance of the telecom sector’s survival cannot be overstated, as it plays a crucial role in realising the nation’s digital aspirations. CEO of Jazz and Chairman of the Prime Minister’s IT & Digital Economy Advisory Council’s Subcommittee on Telecom, Aamir Ibrahim highlighted the sector’s importance, stating that thriving startups, flourishing IT exports, and the overall digital economy heavily rely on the robust broadband connectivity provided by telecom companies.
Recent statistics shared by Ibrahim underscore the telecom sector’s commitment to Pakistan’s digital transformation. Over the past three years, the industry has invested a substantial $4.8 billion to bolster and expand the nation’s digital highways, laying the groundwork for future growth and progress.
However, looming over this potential for growth is the pressing issue of telecom license fees being linked to the US dollar. The industry has raised concerns about the far-reaching impact of this policy. With the devaluation of the Pakistani rupee, spectrum prices, renewals, and instalment interest have all been adversely affected due to the dollar linkage. Over the past two years, forex rates have increased by a staggering 86 per cent, resulting in immense uncertainty and jeopardising the telecom business case.
Despite persistently urging the government to address this “Digital Emergency,” tangible measures have yet to be taken. The fate of the telecom sector, as the backbone of the digital economy, now hangs in the balance, and its survival is crucial for the nation’s economic growth and digital competitiveness.
While the telecom industry remains willing to invest further in digital infrastructure, the uncertainty surrounding license fees has impeded their ability to secure funds and make substantial commitments. Moreover, this uncertainty has the potential to deter foreign investments, further hindering the growth of the digital economy.
The telecom sector’s plea for urgent action comes at a pivotal moment, with the nation’s digital ambitions on the line. Policy reforms under the recently announced Special Investment Facilitation Council (SIFC) could provide a pathway to address the challenges faced by the telecom industry, fostering a thriving IT sector, prosperous startups, and continued growth in IT exports. Stakeholders, citizens, and industry players are now eagerly awaiting the government’s response, hopeful that the call for action from the telecom sector will be heeded. Together, they aim to pave the way for a robust and resilient digital economy, propelling Pakistan into the digital age with determination and foresight.
Regulatory compliance is the adherence of an organization to laws and legal regulations that are relevant to its business. In the context of information and communications technology (ICT), this means that technology products, services, and processes must meet specific standards set forth by regulatory bodies. Non-compliance can lead to hefty fines, litigation, and reputational damage.
Digital transformation initiatives have encouraged people to share more personal and sensitive information online than ever before. Regulatory compliance initiatives seek to mitigate and manage risk by providing standards and best practices for a variety of business and consumer concerns that involve data management, data privacy, cybersecurity, and the ethical use of artificial intelligence (AI).
Other key areas of regulatory compliance in ICT include:
- Data sovereignty
- Environmental impact
- Digital accessibility
- Intellectual property
- Records management and data retention
- Software licensing
- Transparency
- Telecommunications
- Electronic commerce
- Regulatory Compliance Examples
Important laws and regulations that impact information and communications technology (ICT) include:
Digital Services Act – Requires online platforms to be more transparent about their algorithms, remove illegal content quickly, and give users more control over their data. Penalties for non-compliance with the DSA can be up to 6 per cent of a company’s global turnover. The DSA goes into effect on January 1, 2024.
Sarbanes-Oxley Act – Imposes stricter standards for financial reporting, internal controls, and accountability. Non-compliance with SOX can result in criminal penalties, including fines of up to $5 million and imprisonment for up to 20 years for individuals.
Can Spam Act – Requires senders of commercial emails to include certain information in the message, honor opt-out requests, and prohibits deceptive practices. Non-compliance with the CAN-SPAM Act can result in penalties of up to US$43,280 per violation, which can be assessed against each email sent in violation of the law.
Health Insurance Portability and Accountability Act (HIPAA) – Sets standards for the electronic exchange, use, and safeguarding of protected health information (PHI) by healthcare providers and other entities. Non-compliance with HIPAA can lead to civil and criminal penalties, with fines ranging from US$100 to US$50,000 per violation and, in some cases, imprisonment for individuals involved in intentional or wrongful disclosure of PHI. The total annual penalty for each violation category can reach up to US$1.5 million.
Payment Card Industry Data Security Standard (PCI DSS) – Ensures the secure processing, storage, and transmission of payment card information. Fines can range from thousands to millions of dollars and may also include the loss of the non-compliant organization’s ability to process payment card transactions.
EU AI Act – Proposed legislation that regulates the development and use of artificial intelligence (AI) in the European Union. It classifies AI systems into three risk categories: unacceptable risk, high risk, and low/minimal risk. Unacceptable-risk AI systems are banned, while high-risk AI systems must comply with a set of requirements that address safety, transparency, and non-discrimination. Penalties for non-compliance with the AI Act can be up to 7 per cent of a company’s global turnover.
Federal Information Security Management Act (FISMA) – Sets guidelines and standards for information security management within United States federal government agencies. Penalties for non-compliance with FISMA can include various consequences such as financial penalties, restrictions on agency funding, loss of authority to operate IT systems, and potential legal and reputational ramifications for the responsible individuals or agencies involved.
General Data Protection Regulation (GDPR) – Imposes obligations on organizations that collect, process, and store personal data, including obtaining consent, providing data subject rights, implementing security measures, and reporting data breaches. Non-compliance with GDPR can result in significant penalties, including fines of up to €20 million or 4 per cent of the global annual revenue of the non-compliant organization, whichever is higher, depending on the severity and nature of the violation.
Ecodesign Directive in the European Union – Sets requirements for energy efficiency. Non-compliance can result in penalties that vary between member states, but they typically include fines, market access restrictions, product recalls, and other legal actions. The specific penalties depend on the nature and extent of the non-compliance.
Digital Millennium Copyright Act (DMCA) – Criminalizes the circumvention of technological measures used to protect copyrighted works, such as software, and provides a safe harbor for online service providers against copyright infringement liability for user-generated content, as long as they promptly remove infringing material upon notification. Penalties for non-compliance can include civil remedies, such as injunctions and damages, fines, and imprisonment.
Regulatory Guidelines vs. Laws and Regulations
Regulatory guidelines are recommendations, best practices, or advice provided by regulatory bodies to help organizations understand and implement specific regulatory requirements.
Guidelines are non-mandatory. This means that while they provide recommended practices, organizations might not be legally required to follow them. However, adherence to guidelines can often simplify the process of adhering to the specific laws set by regulatory bodies and achieving regulatory compliance.
Laws tend to be broad and general and provide a framework that guides the development of more specific regulations. Regulations provide specific guidelines, and procedures, and dictate the requirements necessary to comply with the broader principles established by the laws.
Both laws and regulations are legally binding, but the enforcement mechanisms can differ. Violating a law is usually a more serious offense and may result in criminal charges or civil penalties. Regulations, while also enforceable, often carry administrative penalties or fines for non-compliance, but they may not necessarily involve criminal charges.
What Are Compliance Burdens?
An organization’s compliance burden consists of the financial, operational, and human resources required to meet regulatory compliance requirements. The burden can vary significantly depending on the industry, geographical location, and the specific regulations that apply to an organization.
They are caused by a number of factors, including:
Regulatory Complexity: Regulations and laws can be complex and subject to frequent changes. Understanding and interpreting these requirements, as well as keeping up with updates, can be challenging and time-consuming.
Documentation and Reporting: Regulatory compliance often involves maintaining extensive documentation, records, and reports to demonstrate adherence to regulations. In a large organization, this may require hiring a Chief Compliance Officer (CCO) and dedicated resources for reporting, record-keeping, and data management activities.
Training and Education: Organizations need to invest in training programmes and educational resources when new laws and regulations go into effect to ensure that employees understand compliance requirements and are equipped to follow the necessary procedures.
Internal Controls and Processes: Implementing and maintaining robust internal controls and processes to ensure compliance requires additional resources, including technology, personnel, and infrastructure.
Compliance Audits: Regularly conducting internal compliance audits (and responding to external audits or inspections) can impose additional burdens on organizations that include dedicating time and resources to addressing audit findings and implementing corrective actions. Compliance audits play an important role in governance, risk, and compliance (GRC) initiatives.
Financial Implications: Non-compliance can involve legal expenses and fines. Organizations must allocate financial resources to cover these potential liabilities.
Advantages of Compliance-as-a-Service
Compliance burdens can be particularly challenging for small and medium-sized enterprises (SMEs) with limited resources. Mitigating an organization’s compliance burden requires effective compliance management strategies, including risk analysis assessments, process optimization, automation, and regular training and communication to ensure efficient and cost-effective compliance practices.
Compliance-as-a-Service (CaaS) providers can help SMEs reduce the burden of managing complex compliance tasks internally. This type of cloud service allows organizations to leverage the expertise and resources of the service provider and minimize the risk of non-compliance by:
Continuously monitoring regulatory changes and updates to ensure that the organization remains compliant with applicable laws and regulations.
Identifying and assessing potential security risks within the organization, evaluating their potential impact on compliance, and developing strategies to mitigate them.
Developing and maintaining comprehensive training materials for stakeholders.
Conducting internal audits to assess compliance levels, identifying areas for improvement, and generating reports that can be used to demonstrate compliance to regulators and clients.
Providing up-to-date information on regulatory changes, industry best practices, and emerging compliance requirements.
